CVE-2024-24806

一、漏洞信息
 漏洞编号：[CVE-2024-24806](https://nvd.nist.gov/vuln/detail/CVE-2024-24806)
 漏洞归属组件：[libuv](https://gitee.com/src-openeuler/libuv)
 漏洞归属的版本：1.38.1,1.40.0,1.42.0,1.44.1,1.44.2,1.47.0
 CVSS V3.0分值：
  BaseScore：9.8 Critical
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
 漏洞公开时间：2024-02-08 06:15:10
 漏洞创建时间：2024-02-08 06:31:15
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-24806
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | http://www.openwall.com/lists/oss-security/2024/02/08/2 |  |
| security-advisories.github.com | http://www.openwall.com/lists/oss-security/2024/02/11/1 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24806 | https://bugzilla.suse.com/show_bug.cgi?id=1219724 |
| suse_bugzilla | https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 | https://bugzilla.suse.com/show_bug.cgi?id=1219724 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-24806 | https://bugzilla.suse.com/show_bug.cgi?id=1219724 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2263292 | https://bugzilla.suse.com/show_bug.cgi?id=1219724 |
| suse_bugzilla | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 | https://bugzilla.suse.com/show_bug.cgi?id=1219724 |
| suse_bugzilla | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 | https://bugzilla.suse.com/show_bug.cgi?id=1219724 |
| suse_bugzilla | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 | https://bugzilla.suse.com/show_bug.cgi?id=1219724 |
| redhat_bugzilla | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 | https://bugzilla.redhat.com/show_bug.cgi?id=2263292 |
| redhat_bugzilla | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 | https://bugzilla.redhat.com/show_bug.cgi?id=2263292 |
| redhat_bugzilla | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 | https://bugzilla.redhat.com/show_bug.cgi?id=2263292 |
| redhat_bugzilla | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 | https://bugzilla.redhat.com/show_bug.cgi?id=2263292 |
| redhat_bugzilla | https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 | https://bugzilla.redhat.com/show_bug.cgi?id=2263292 |
| cve_search |  | https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 |
| cve_search |  | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |
| cve_search |  | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |
| cve_search |  | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 |
| cve_search |  | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |
| cve_search |  | http://www.openwall.com/lists/oss-security/2024/02/08/2 |
| cve_search |  | http://www.openwall.com/lists/oss-security/2024/02/11/1 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-24806 | https://explore.alas.aws.amazon.com/CVE-2024-24806.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24806 | https://explore.alas.aws.amazon.com/CVE-2024-24806.html |
| snyk | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBUVLIBUV-6234013 |
| snyk | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBUVLIBUV-6234013 |
| snyk | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBUVLIBUV-6234013 |
| snyk | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBUVLIBUV-6234013 |
| security-advisories.github.com | http://www.openwall.com/lists/oss-security/2024/02/08/2 |  |
| security-advisories.github.com | http://www.openwall.com/lists/oss-security/2024/02/11/1 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |  |
| security-advisories.github.com | https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |  | security-advisories.github.com |
|  |  | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |  | security-advisories.github.com |
|  |  | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 |  | security-advisories.github.com |
|  |  | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |  | security-advisories.github.com |
|  |  | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |  | suse_bugzilla |
|  |  | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |  | suse_bugzilla |
|  |  | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |  | suse_bugzilla |
|  |  | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |  | redhat_bugzilla |
|  |  | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |  | redhat_bugzilla |
|  |  | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 |  | redhat_bugzilla |
|  |  | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |  | redhat_bugzilla |
|  |  | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |  | snyk |
|  |  | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |  | snyk |
|  |  | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 |  | snyk |
|  |  | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |  | snyk |
|  |  | http://www.openwall.com/lists/oss-security/2024/02/08/2 |  | nvd |
|  |  | http://www.openwall.com/lists/oss-security/2024/02/11/1 |  | nvd |
|  |  | https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629 |  | nvd |
|  |  | https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70 |  | nvd |
|  |  | https://github.com/libuv/libuv/commit/c858a147643de38a09dd4164758ae5b685f2b488 |  | nvd |
|  |  | https://github.com/libuv/libuv/commit/e0327e1d508b8207c9150b6e582f0adf26213c39 |  | nvd |
|  |  | https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      在`src/unix/getaddrinfo.c`文件中的`uv_getaddrinfo`函数在调用`getaddrinfo`之前会将主机名截断为256个字符。攻击者可以利用这个行为创建类似于`0x00007f000001`的地址，`getaddrinfo`会将其视为有效地址，从而允许攻击者构造解析到意外IP地址的有效负载，绕过开发人员的检查。漏洞是由于`uv_getaddrinfo`函数中处理`hostname_ascii`变量（长度为256字节）的方式以及后续处理`uv__idna_toascii`方法中引起的。当主机名超过256个字符时，它会被截断但不会添加终止空字节。因此，如果恶意用户选择一个较长的易受攻击的用户名，攻击者可能能够访问内部API或类似于 MySpace 的允许用户拥有 `username.example.com` 页面的网站。对这些用户页面进行爬取或缓存的内部服务可能会受到SSRF攻击的威胁。  
 openEuler评分：
  9.8
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(1.44.1):受影响
2.openEuler-20.03-LTS-SP1(1.42.0):受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS(1.42.0):受影响
5.openEuler-22.03-LTS-Next(1.42.0):受影响
6.openEuler-22.03-LTS-SP1(1.44.1):受影响
7.openEuler-22.03-LTS-SP2:受影响
8.openEuler-22.03-LTS-SP3:受影响

修复是否涉及abi变化(是/否)：
  1.master(1.44.1):否
2.openEuler-20.03-LTS-SP1(1.42.0):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(1.42.0):否
5.openEuler-22.03-LTS-Next(1.42.0):否
6.openEuler-22.03-LTS-SP1(1.44.1):否
7.openEuler-22.03-LTS-SP2:否
8.openEuler-22.03-LTS-SP3:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1200

src-openEuler/libuv
关闭

内容风险标识

评论 (11)

src-openEuler/libuv关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-24806

评论 (11)

搜索帮助

src-openEuler/libuv
关闭